3b76929281ea5b00db430c81ee4c304c552d116eff2a2022019e44e3179f1771

General

Target
1111.zip
Size 7.3MB
Sample260813-yqscssdb37
SHA256 3b76929281ea5b00db430c81ee4c304c552d116eff2a2022019e44e3179f1771
MD5 743bffab2614536dc524b78e541c6125
SHA1 4923297294f8526a3bec6e3a6cb13baaa4a4b67a
SHA512 1bc0ff9cb7b94a7666657000831c9c5f8385a426271d739b65215a57fec4637616d0e74d1dc79f0bc948e462792493bca1008cd76d5fc840df115970f0ad2b94
SSDEEP 196608:Rt/G33QSr4OaIpPh0rzHWjiIBiKSl5Uw69UiAIsHm:RtA1bBpPhVW+SE6iJim
TLSH
T18F76331CC7F5270A299E0278058349CCC8C6B8B75AE57C98FF38CE31A612FE5E55552B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  1111/Anubis.msi
- Size 889KB
- SHA256 d9f0f2b97e4d3052928668dcbdb4213172d170a550bbde601b122472a376cbfb
- MD5 6150e9e74f15969a444b4b6db1917fd4
- SHA1 e3b76ae16d486ef4aec5763a65b885fab9e0fd2c
- SHA512 a6cbdca8dd0a8c51ab3f3567b40b796e62d0d51f11af271904373906deef6bb83c835a71b88bfbc790bb6e8754a80e7f96aefd69151a7912cfd9293fceaeb499
- SSDEEP 12288:b3Fb9qcBJiDRGF8QV9JnGYbYSKCubO+ZiY+9b:b35VLiszGMYSZC5IY+h
- TLSH
  T1C415AE1273A68131E1934131A66F9B119B3ABC305BF0C78B7390772E2D727E1AE35766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  1111/setup.exe
- Size 398KB
- SHA256 269180939e05790ca5fd2e1155a78dec0c890a012d6285d53e07d538e29455ce
- MD5 5e258ea11585f0170ba28bdf6d376dee
- SHA1 1ac8cc2140fb6f6925c336961b8bee0b04f048cc
- SHA512 1798405b5dd6093cbc4fdc93f24712f61f8c38364338e9c8c70fb1bc354895bc1bd719d28ff6354dc86b27c0b0baf05c12bd630e726b0e07651a9160e24ace42
- SSDEEP 6144:3DI8JDRdozHIjc1eBEhHE52AlOpK4sL5nEHFVeu22ZXL//3Vpb4FWaVgXA2P:3DzJDR6qlSKlLVr2ZXvA2
- TLSH
  T134844913B7E8A035E1B307706B3A67904ABEBC715D31C61F23D8891E5AB4981FD21B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  1111/vcredist_x64.exe
- Size 6.9MB
- SHA256 e3f98a925c9c4daf2638166f7da66a049d814b8bc3c3d0a928cebd5c17fff641
- MD5 77ca8f996f83df7676c855a901ed90bc
- SHA1 09228fe38b82951523ef00f0ef2e9f0adc11682a
- SHA512 181fbf16655885f30d5751cda67369c8201047a75da678c56f96809cf89ee92f09ccc2b1459483826fbb6b4c779ac5e03f6e4318039405b3557937c66a849dc8
- SSDEEP 196608:m9OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Jz5x7jLXkmkU4cFe
- TLSH
  T11C763331E7B01023D6F201B2E411D5287E3DB2291F109CAAD794DD2D3AA9AD6E7F7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6